Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Stored XSS in Question edit from product name#1416672 | Valid | Cross-site Scripting | Medium | 2022-03-31 | $500 | 7 |
| Stored XSS in Question edit for product name (bypass #1416672)#1428207 | Valid | Cross-site Scripting | Medium | 2022-03-31 | $500 | 11 |
| Self-XSS due to image URL can be eploited via XSSJacking techniques in review emailAnalysed#1397940 | Valid | No weakness recorded | Medium | 2023-02-01 | – | 14 |
| stored XSS on AliExpress Review Importer/Products when delete productAnalysed#1425882 | Valid | Cross-site Scripting | Medium | 2022-03-31 | $500 | 15 |
| XSS in Widget Review Form Preview in settingsAnalysed#1595905 | Valid | Cross-site Scripting | Medium | 2022-09-29 | – | 16 |
| Improper Access Control in Ali Express ImporterAnalysed#1609955 | Valid | Access Control | Medium | 2023-02-01 | – | 21 |
| Stored XSS in "product type" field executed via product filtersAnalysed#1404770 | Valid | No weakness recorded | Medium | 2022-04-26 | $500 | 30 |
| Stored XSS in Email Templates via linkAnalysed#1376672 | Valid | Cross-site Scripting | Medium | 2021-11-18 | $500 | 81 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.